Privacy Policy

Effective date: October 30, 2026
Version: 1.2

1. Who we are and what this policy covers

No-Gi Blueprint LLC, a California limited liability company ("No-Gi Blueprint," "we," "us," or "our"), operates the No-Gi Blueprint website and applications (the "Service") and is responsible for the personal information described here. This policy covers public browsing, accounts, personal training workspaces, athlete sharing, coaching groups, and related support and device features. Contact privacy@nogiblueprint.com with questions or requests, including if you do not have an account.

This policy describes our practices. Acknowledging it does not waive your privacy rights or provide blanket consent to optional tracking or unrelated uses. Section 6 explains how a coach's separate training records differ from your personal workspace.

2. Information you or other people provide

Accounts and access. We process email addresses, account and authentication-provider identifiers, display names and other basic profile information supplied through sign-in, verification and session status, account preferences, and plan/access entitlements. Supabase processes authentication credentials and verification, sign-in, and recovery requests. If you choose Google sign-in, Google and Supabase exchange the information needed to authenticate you under the permissions presented in that flow. We also keep the versions of legal documents you acknowledge, acknowledgment time, and source.

Athlete profiles. Personal profiles, also called archetypes, can include a name, height, weight or weight class, sex selection, training start date or years of training, measurement units, and self-assessed flexibility, mobility, strength, and explosiveness. Optional attributes can be left blank. Coaches can enter similar attributes in their own roster records. These are training-planning inputs, not verified measurements or medical evaluations. Depending on their content and applicable law, physical attributes, fitness assessments, and training records may be sensitive or consumer health information.

Personal workspaces and training. We process saved blueprints and paths, finishes, positions, steps, connections and variations, defensive gaps, familiarity and proficiency assessments, training focus, weak-point notes, source/video references, study progress, and other content you choose to save. Training logs can include dates, drilling/sparring/competition context, round duration, repetitions, attempts, successes, selected goals, goal checkoffs, and notes. Saved records can include recommendation reasons, content and algorithm versions, and creation, revision, and synchronization timestamps.

Coaching and student records. A coach can supply a student's name, email when provided, experience, rank label, training start date, profile attributes, goals, and next focus. We store group membership, class schedules and timezones, planned and taught activities, attendance, lesson/curriculum versions, assignments and completion, observations, assessments, feedback visibility, and corrections. Some records describe people who have not created an account. A coach or someone sharing with you may therefore be the source of information about you.

Sharing, invitations, and support. We process recipient email addresses, inviter/owner and recipient account identifiers, the selected athlete or group, access roles, invitation codes, expiry and acceptance status, revocations, and delivery/audit records. If you contact us, we process the name, email, subject, message, and correspondence you provide. Share another person's information only with lawful authority, and give them appropriate notice. Do not enter medical records, diagnoses, injury histories, identity documents, passwords, or identifiable records about minors. Free-text information you submit is still processed even if we ask you not to include it.

3. Technical information, analytics, and acquisition

Service operation. Our hosting, authentication, email, and infrastructure providers may process IP addresses, browser/device characteristics, request times, pages/endpoints, referrer information, errors, and security or delivery logs to deliver and protect the Service. These operational records are separate from product analytics.

First-party product analytics. In production, we record a limited set of events, such as page visits, opening the builder, selecting a finish, generating or opening a path, and saving a profile or cloud workspace. Events can include a random browser identifier, session identifier, signed-in user identifier when available, application route, canonical finish identifier/name, route scope, counts of steps or gaps, and success/failure or signed-in indicators. Random identifiers are pseudonymous; events associated with your account are not anonymous.

Acquisition and invitations. We measure how people reach the Service and complete signup using allowlisted source, medium, campaign, content and public QR campaign tags, public landing-page categories, referrer hostname, timestamps, and reported platform. Where available, attribution can be associated with a completed signup, account identifier, or invitation record. A public marketing QR visit is different from a private athlete/group invitation.

Product and acquisition analytics are designed to exclude email addresses, athlete names, physical attributes, private notes, training history, recipient details, video URLs, and arbitrary query strings. Training, coaching, assigned-training, and coaching-invitation routes are excluded from product page events. Operational invitation records can still retain a recipient's email for delivery and abuse prevention. Authorized administrators use aggregate dashboards to understand acquisition, account setup, reliability, and product use. Section 9 explains storage and tracking choices.

4. Local storage, cloud saves, and mobile apps

Guest workspaces can remain in browser/device storage. Uploading a workspace or using account cloud-save features sends the relevant information to our servers and providers for storage and synchronization. Coaching records are stored on the server. Offline or unfinished drafts are not guaranteed to synchronize or survive a reload, and local storage is not a cloud backup.

The website and installed web app use browser storage, authentication cookies, preferences, and service-worker caches. The Android browser-based app uses its selected browser's storage and sign-in context. In supported native iOS builds, sign-in/session secrets use device-only Keychain storage; account workspaces use the same cloud service, and unsaved private drafts stay in app memory. The native iOS account client does not add advertising identifiers or the website's product analytics. Network and backend processing still occurs.

Clearing site data, changing browsers/devices, or uninstalling can remove local work. Signing out, revoking a share, or deleting server records does not remotely erase every local copy, export, or recipient's saved copy. Even local-only work involves ordinary network requests for the site and any external content you request.

5. How we use information

We use information to authenticate accounts; store and synchronize requested workspaces; personalize and explain grappling recommendations; display study and training progress; provide selected sharing; manage coaching rosters, schedules, attendance, teaching material, assignments, and feedback; deliver invitations, account messages, and optional class alerts; respond to support and privacy requests; maintain plan/access permissions; prevent abuse; diagnose and improve the product; document changes and agreement versions; and meet legal obligations.

Recommendations use selected profile attributes, saved plans, and product activity. They are recreational planning aids, not medical advice or automated decisions about employment, credit, insurance, or another essential service. We do not use private workspaces or coaching records to train general-purpose AI models or send private training notes to an external generative AI service for recommendations. A materially different future AI use would require review, appropriate disclosure, and any consent or safeguards required by law.

Physical and training information is used for the features requested, including sharing you authorize, rather than advertising. Where applicable law requires consent for a particular collection or disclosure, that requirement applies separately from acknowledging this policy. Current Pro and Coach access records describe feature entitlements; checkout is not connected in this release and the app does not collect payment-card details.

6. Athlete sharing and independent coaching records

Personal profile sharing. You can grant access to a selected athlete through an email invitation or QR claim. Recipients can receive the shared identity, profile attributes, and paths. A coach grant also permits access to private training notes and evidence and editing of the granted athlete and existing paths. A training partner grant is read-only and excludes private training observations, study history, familiarity, training focus, and troubleshooting notes. Your other athletes and paths are not included merely because you share one athlete. Access creation, acceptance, role changes, revocation, and coach edits generate audit records.

Group membership and profile sharing are separate. Joining a coaching group links your verified account to a roster identity and makes the relevant schedule, your attendance, assigned material, and feedback marked for student visibility available to you. It does not automatically share your personal workspace with the coach. If you separately opt to share a personal profile during joining, the choice grants the disclosed coach access, including editing and private training notes. Other students do not gain access to your personal workspace or coach-private feedback through group membership.

A coach's own records. A coach can create roster, attendance, observation, assignment, and profile-snapshot records without a student account. These records are separate from a student's personal workspace; linking or updating a shared personal profile does not automatically merge or erase the coach's history. Coaches decide what to enter, why to maintain it, and what feedback to share. We process those records to provide their coaching tools, and handle our own account, security, support, and analytics processing as described here. A coach or gym may have separate privacy responsibilities and notices.

You can revoke personal sharing through the access controls. Group/roster access is managed separately; contact the coach or privacy@nogiblueprint.com for help. Revocation stops future access through the relevant grant. It does not retract information already viewed, copied, or exported, delete independent coaching records, or automatically remove another separate grant. Contact us about access, correction, or deletion of records about you even if you have no account; we may coordinate with the coach while honoring applicable rights.

7. Camera scanning and optional class alerts

Camera. Where QR scanning is offered, camera access is requested through your browser/device permission prompt. The scanner decodes invitation codes on your device; camera frames are not uploaded or stored by the QR feature. The decoded invitation identifier/link is sent to the Service to preview or accept it. You can paste an invitation link instead and revoke camera permission in browser/device settings. QR invitations are access-bearing links; share them only with the intended recipient. The current release does not offer training-video/audio recording or uploads, microphone access, or photo-library access.

Class alerts. If you enable device clock alerts where supported, we store your account identifier, push subscription endpoint, delivery-encryption keys, enabled/disabled status, and delivery records associated with a class/timer. Browser/device push services, such as those operated by Apple, Google, Mozilla, or Microsoft, route notifications. Alerts can include a class title, next activity, and a link back to the class, and may appear on a lock screen or shared device. You can disable alerts in the class clock or browser/device notification settings. Disabling alerts stops future delivery; it does not itself delete retained subscription or delivery records. Other clock preferences can stay on your device.

8. Other recipients and external services

Service providers. Vercel hosts the web service; Supabase provides database and authentication services; Resend handles support-form messages and sharing emails, with account-email delivery provided through the configured authentication email service. Hosting, security, email, support, and push providers receive information appropriate to their functions, including message content or destination details needed for delivery, under applicable contracts and law. Authorized personnel can access information as needed for operation, support, security, and legal responsibilities.

External content and sign-in. Loading an external player, thumbnail, image, or linked site, including YouTube or Instagram content, may send its provider your IP address, browser details, page/referrer information, and applicable cookies or account identifiers. A provider may associate the interaction with your account and collect activity across sites under its own policy. Google sign-in and device/browser push services also have their own privacy practices. Review their policies and settings. A privacy-enhanced embed does not eliminate all third-party transfers, and an external player is not necessarily anonymous.

Legal, safety, and business circumstances. We may disclose information when reasonably necessary to comply with lawful demands, investigate abuse, protect rights and safety, establish or defend claims, or carry out a lawful merger, financing, acquisition, or business transfer, subject to appropriate safeguards and required notices or permissions. A transfer does not remove existing privacy commitments. We may also disclose information at your express direction.

We do not sell personal information or disclose it for cross-context behavioral advertising. This commitment does not mean that no provider or authorized sharing recipient receives information. A personal workspace is not public simply because you create an account.

9. Cookies, storage, and tracking choices

Necessary cookies/storage support sign-in, local workspaces, preferences, and reliable operation. Blocking or clearing them can prevent sign-in or erase local work. Product analytics use a random browser identifier in local storage and a session identifier in session storage. These identifiers can remain until the relevant storage is cleared or the browser session ends. The first-party acquisition cookie, ngb_acquisition_v1, expires 30 days after the first recorded visit, rather than extending by another 30 days on each visit. Its expiry does not delete already recorded server events or signup attribution.

The website's optional product-event and acquisition capture skips collection when your browser exposes Do Not Track set to "1" or Global Privacy Control as enabled. Signup-attribution processing also checks corresponding request headers. These signals do not disable necessary authentication/security processing or delete previously stored records. You can manage cookies and site storage in your browser and contact us about retained information.

We do not use first-party advertising pixels or cross-site behavioral advertising. External content providers may use their own tracking. Where applicable law requires prior consent for optional cookies or analytics, a separate valid choice is required; accepting the Terms or acknowledging this policy does not supply that consent.

10. Retention and deletion

In the app or website, open Account settings → Delete account. You can also use https://www.nogiblueprint.com/delete-account from any browser, including after uninstalling the Android app. Request a fresh code at your account email, enter it, type DELETE and confirm the permanent deletion. We verify account ownership before processing; a request to send a code alone never deletes an account. You do not need a password, a new agreement, or an installed app. If you cannot access your account email or automated verification fails, email privacy@nogiblueprint.com for a proportionate, support-assisted ownership check.

After your verified request is recorded, account access is blocked and automated processing normally starts within a few minutes. We remove account credentials and profile, cloud athlete profiles and Blueprints, defensive assessments, training logs and observations, study history, account entitlements, sharing permissions and invitations, linked analytics and acquisition records, and notification subscriptions. The deletion screen shows processing until the required active-system cleanup and Auth deletion succeed. Technical failures are retried durably; unresolved dependencies show a support-needed state. Return in the initiating browser to check progress for 30 days. Contact privacy@nogiblueprint.com with your request reference if processing remains incomplete after 24 hours. Support-assisted requests are handled within applicable legal time limits.

Coaching and shared records. Deleting a coach account removes its owned workspace, roster, groups, lessons and revisions, curricula, classes, attendance, assignments, invitations, notes and operational history. Students' independent accounts, personal workspaces and unrelated coaching relationships survive. Deleting an athlete removes roster identities matched by account links, shared-profile sources or verified email across coaching relationships, including related profile snapshots, attendance, assignments and coach-authored notes. Identifying references in related teaching snapshots, recaps and audit payloads are removed or redacted, and affected mutation receipts are erased. We do not retain identifiable athlete information solely because someone else authored it. Unlinked records that cannot safely be matched require help to locate; identify the relevant coach or group when contacting privacy support. A coach's independently exported copies and copies already held on another device cannot be erased remotely.

Subscriptions and exceptions. Current Pro and Coach access grants are erased; checkout is not connected in this release. Account deletion does not itself cancel billing with Google Play, Apple or another payment provider. Manage any subscription with its provider or contact us for assistance; billing does not unnecessarily block account deletion. We do not routinely retain deleted training data or invent a financial-record exception where no payment integration exists. A specific lawful preservation requirement is handled individually, limited to necessary records and duration, and explained to the requester.

We keep a minimal operational receipt for 30 days after completion, containing an opaque request reference/digest, status and timestamps, without your email or account identifier. Incomplete jobs retain the account reference needed to finish and resolve failures, with access restricted to service operations. Abuse-limiter records contain keyed digests rather than email/IP values and expire after one day of inactivity.

Active-system deletion and expiry from provider security logs, already-delivered email and historical backups follow different lifecycles. We do not promise instant backup erasure or a fixed provider expiry period that has not been verified. Historical backups remain restricted and subject to provider lifecycle safeguards; restoration must reapply deletion requests before ordinary account access resumes. Local drafts, exports, guest work and copies on other devices are not remotely erased. Clear No-Gi Blueprint site data in your browser/device settings to remove local copies; this also removes guest work. Signing out or uninstalling alone does not close an account. Archiving, unlinking or downgrading a plan is distinct from verified account deletion and may preserve ordinary coaching history.

11. Your choices and privacy requests

You can browse public material without an account, leave optional attributes blank, edit available profile/workspace fields, manage sharing, and use export/deletion controls where offered. Camera and notifications are optional. To request access, correction, a usable copy, deletion of information, or account closure, use the process in Section 10 or email privacy@nogiblueprint.com, including from outside the app. You do not need to accept new commercial terms to submit a privacy request.

We may proportionately verify your identity before disclosing or changing private records. If the request concerns a coach's records, identify the coach/group so we can locate them; you need not create an account. Do not email identity documents unless we explain the need and provide an appropriate secure method. Authorized agents can make requests where applicable law permits.

Depending on your location and applicable law, you may also have rights to object to or restrict processing, withdraw consent, limit certain uses of sensitive/consumer health information, appeal a denial, or complain to a regulator. Contact the same inbox to exercise those rights or request an appeal, and identify the decision you want reviewed. We respond within applicable legal time limits, explain relevant limitations, and do not unlawfully discriminate for exercising privacy rights. Withdrawal or deletion may affect a feature that needs the information, but does not retrospectively invalidate lawful processing.

12. Security

We use reasonable administrative and technical safeguards, including authenticated access and controls intended to separate accounts, private workspaces, and coaching groups. No service or transmission method is perfectly secure. Cloud storage is not represented as end-to-end encrypted against us or all authorized providers. Protect sign-in access, private invitation links, exports, and shared devices. Report suspected security problems to support@nogiblueprint.com. We will assess incidents and provide notifications as required by applicable law.

13. Adults and children's information

Accounts are intended for people who are at least 18 and legally adults where they live. We do not offer children's accounts or knowingly collect personal information from children under 13. Coaches and other users must not use this release to maintain profiles, rosters, or identifiable training records about minors. Contact privacy@nogiblueprint.com if you believe a child's information was submitted, including through a coach. We will assess the report and take appropriate action, including deletion where required. These restrictions do not remove duties that arise when we learn children's information is being processed.

14. Location and international processing

We operate from the United States. Providers may process information in the United States and other locations where they operate, and authorized sharing recipients may be elsewhere. Privacy laws differ between locations. Where applicable law requires additional protections, a lawful processing basis, or an international-transfer mechanism, those requirements apply. Using the Service or acknowledging this policy does not waive them or substitute for a required consent or safeguard.

15. Changes and contact

We identify revised policies by effective date and version and retain prior versions at /privacy/1.0 and /privacy/1.1. For material changes, we provide notice through the Service or another appropriate channel before the change takes effect where required, and obtain consent when required for changed processing. A revised notice does not authorize unrelated uses or retroactively create consent.

Operator: No-Gi Blueprint LLC
Mailing address: 2406 Aviation Boulevard, Unit F, Redondo Beach, CA 90278-2334, United States
Privacy requests and questions: privacy@nogiblueprint.com
Other support: support@nogiblueprint.com